refactor(show-access): retire legacy Show Page email authorization

[cyhhao]

Refs #1498

Contract

Keep /p admission single-axis and local: ShowAccess owns private/limited/public plus email/group/organization whitelist matching. Backend supplies only verified identity and optional organization claims. /show is gated by Instance role; a Limited guest lease is read-only and cannot reach HMR or annotation capability.

Changes

• Remove the legacy show_page_email Instance source, page-scoped claims, OAuth scope/gate/compatibility branches, and old scenario harness/tests.
• Keep and strengthen local Limited guest lease matching for email/group/organization, including non-ASCII identity data in the scenario contract.
• Make /show viewer/editor boundaries role-only and keep guest canAnnotate false.

The inventory found no current /p consumer of hosted authorized-emails, remote_access_show_page_email_grants, or backend show_page_email OIDC flow. Generic resource-sync show_page code remains outside this retired hosted model because it has no current /p consumer.

Validation

• Focused Python contract/authorization/UI/scenario suite: 833 passed.
• UI Vitest: 251 files, 3,284 passed; UI build and lint pass.
• Full Python suite: 12,886 passed, 62 skipped, 1 xfailed, 9 failures. The 7 non-Show failures are pre-existing Harness/Office-environment failures; the 2 Show assertions were updated for the role-only contract and pass in focused coverage.
• Real cross-repo probe: a Backend getSigner().signVerifiedIdentityAssertion RS256 JWT with non-ASCII subject/organization/member/group claims was verified by Avibe through a local JWKS server, admitted into Limited /p by a group lease, denied /show, and returned canAnnotate:false.
• Local Incus acceptance is blocked by evidence: Incus 7.1 client reports server unreachable and no configured local remote. No remote tenant/customer environment was used.

Cross-repo order

This PR is independent (not stacked). Recommended order is merge and deploy the backend PR first, then merge and deploy this Avibe PR. Do not merge either PR as part of this change.

[cyhhao]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 16b569f56b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".